linux-kernel - Re: [syzbot] [ext4?] general protection fault in ext4_quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 30 Jun 2023 13:48:45 -0400
From:   "Theodore Ts'o" <tytso@....edu>
To:     syzbot <syzbot+b960a0fea3fa8df1cd22@...kaller.appspotmail.com>
Cc:     adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        llvm@...ts.linux.dev, nathan@...nel.org, ndesaulniers@...gle.com,
        syzkaller-bugs@...glegroups.com, trix@...hat.com
Subject: Re: [syzbot] [ext4?] general protection fault in ext4_quota_read

On Fri, Jun 30, 2023 at 07:41:54AM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    6995e2de6891 Linux 6.4
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=175bc8bf280000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f4df35260418daa6
> dashboard link: https://syzkaller.appspot.com/bug?extid=b960a0fea3fa8df1cd22
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17e661af280000

There is a syz reproducer, but no C reprodducer.  Looking at the syz
reproducer, though, it looks like this is another one of these "let's
flip the mounted file system between r/o and r/w", with the added
"fun" that it appears that the mounted file system has a corrupted set
of quota inodes.  (See below.)

Looking at the stack trace, it looks like we're passing an invalid
inode pointer to ext4_quota_read() from do_insert_tree() which is
ultimately called from dquot_file_open() while trying to open an ext4
file.

Jan, since I know you're working on reworking the quota code to handle
crazy (and as Linus says, crazy userspace doesn't come more crazy than
syzbot) r/o <-> r/w racing remounts with quota enabled, over to you.  :-)

       		     	   	    	 - Ted

e2fsck 1.47.0 (5-Feb-2023)
Pass 1: Checking inodes, blocks, and sizes
Inode 3, i_blocks is 16, should be 8.  Fix? no

Inode 15, i_size is 360287970189639690, should be 4096.  Fix? no

Inode 16, i_size is 9000, should be 20480.  Fix? no

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
Block bitmap differences:  -10
Fix? no

Free blocks count wrong for group #0 (41, counted=18).
Fix? no

Free blocks count wrong (41, counted=18).
Fix? no

Padding at end of block bitmap is not set. Fix? no

[ERROR] ../../../../lib/support/quotaio_tree.c:546:check_reference: Illegal reference (975616 >= 6) in user quota file
Update quota info for quota type 0? no

[ERROR] ../../../../lib/support/quotaio_tree.c:546:check_reference: Illegal reference (196613 >= 6) in group quota file
Update quota info for quota type 1? no

syzkaller: ********** WARNING: Filesystem still has errors **********

syzkaller: 17/32 files (0.0% non-contiguous), 0/41 blocks